Comparing Lexical Analysis Tools for Buffer Overflow Detection in Network Software

Many of the bugs in distributed software modules are security vulnerabilities, the most common and also the most exploited of which are buffer overflows and they typically arise in programs written in the C language. This paper, focusing on static analysis tools for detecting buffer overflows in C programs, presents a methodology for experimentally evaluating and comparing the main objective features of such tools. The proposed method is based on testing all the tools on a common set of publicly available, open source software packages, and makes use of specific metrics defined to evaluate the main tool features. In particular, the evaluation aims at quantifying how close the tool is to a complete and sound tool. Our approach has been applied for an initial evaluation of the class of static analysis tools that are based on lexical analysis, using as test cases three well known network software packages. The results obtained, illustrated and commented on in this paper, offer some interesting indications

[1]  Pascal Meunier,et al.  Can source code auditing software identify common vulnerabilities and be used to evaluate software security? , 2004, 37th Annual Hawaii International Conference on System Sciences, 2004. Proceedings of the.

[2]  M. Weber,et al.  A case study in detecting software security vulnerabilities using constraint optimization , 2001, Proceedings First IEEE International Workshop on Source Code Analysis and Manipulation.

[3]  Gary McGraw,et al.  ITS4: a static vulnerability scanner for C and C++ code , 2000, Proceedings 16th Annual Computer Security Applications Conference (ACSAC'00).

[4]  Linda Pesante,et al.  CERT® Coordination Center , 2002 .

[5]  Tadayoshi Kohno,et al.  Token-based scanning of source code for security problems , 2002, TSEC.

[6]  Paul Anderson,et al.  Tool Support for Fine-Grained Software Inspection , 2003, IEEE Softw..

[7]  John Wilander,et al.  A Comparison of Publicly Available Tools for Static Intrusion Prevention , 2002 .

[8]  Kyung-Suk Lhee,et al.  Buffer overflow and format string overflow vulnerabilities , 2003, Softw. Pract. Exp..

[9]  Jonathan D. Pincus,et al.  Beyond stack smashing: recent advances in exploiting buffer overruns , 2004, IEEE Security & Privacy Magazine.